no slosilo dependency; use path-based URLs for roles, similar to resources